test/units/testsuite-75.sh

   1 #!/usr/bin/env bash
   2 # SPDX-License-Identifier: LGPL-2.1-or-later
   3 # vi: ts=4 sw=4 tw=0 et:
   4
   5 # TODO:
   6 #   - IPv6-only stack
   7 #   - mDNS
   8 #   - LLMNR
   9 #   - DoT/DoH
  10
  11 set -eux
  12 set -o pipefail
  13
  14 # shellcheck source=test/units/util.sh
  15 . "$(dirname "$0")"/util.sh
  16
  17 # We need at least Knot 3.0 which support (among others) the ds-push directive
  18 if ! knotc -c /usr/lib/systemd/tests/testdata/knot-data/knot.conf conf-check; then
  19     echo "This test requires at least Knot 3.0. skipping..." | tee --append /skipped
  20     exit 77
  21 fi
  22
  23 RUN_OUT="$(mktemp)"
  24
  25 run() {
  26     "$@" |& tee "$RUN_OUT"
  27 }
  28
  29 run_delv() {
  30     # Since [0] delv no longer loads /etc/(bind/)bind.keys by default, so we
  31     # have to do that explicitly for each invocation
  32     run delv -a /etc/bind.keys "$@"
  33 }
  34
  35 disable_ipv6() {
  36     sysctl -w net.ipv6.conf.all.disable_ipv6=1
  37 }
  38
  39 enable_ipv6() {
  40     sysctl -w net.ipv6.conf.all.disable_ipv6=0
  41     networkctl reconfigure dns0
  42     /usr/lib/systemd/systemd-networkd-wait-online --ipv4 --ipv6 --interface=dns0:routable --timeout=30
  43 }
  44
  45 monitor_check_rr() (
  46     set +x
  47     set +o pipefail
  48     local since="${1:?}"
  49     local match="${2:?}"
  50
  51     # Wait until the first mention of the specified log message is
  52     # displayed. We turn off pipefail for this, since we don't care about the
  53     # lhs of this pipe expression, we only care about the rhs' result to be
  54     # clean
  55     timeout -v 30s journalctl -u resolvectl-monitor.service --since "$since" -f --full | grep -m1 "$match"
  56 )
  57
  58 restart_resolved() {
  59     systemctl stop systemd-resolved.service
  60     (! systemctl is-failed systemd-resolved.service)
  61     # Reset the restart counter since we call this method a bunch of times
  62     # and can occasionally hit the default rate limit
  63     systemctl reset-failed systemd-resolved.service
  64     systemctl start systemd-resolved.service
  65     systemctl service-log-level systemd-resolved.service debug
  66 }
  67
  68 # Test for resolvectl, resolvconf
  69 systemctl unmask systemd-resolved.service
  70 systemctl enable --now systemd-resolved.service
  71 systemctl service-log-level systemd-resolved.service debug
  72 ip link add hoge type dummy
  73 ip link add hoge.foo type dummy
  74 resolvectl dns hoge 10.0.0.1 10.0.0.2
  75 resolvectl dns hoge.foo 10.0.0.3 10.0.0.4
  76 assert_in '10.0.0.1 10.0.0.2' "$(resolvectl dns hoge)"
  77 assert_in '10.0.0.3 10.0.0.4' "$(resolvectl dns hoge.foo)"
  78 resolvectl dns hoge 10.0.1.1 10.0.1.2
  79 resolvectl dns hoge.foo 10.0.1.3 10.0.1.4
  80 assert_in '10.0.1.1 10.0.1.2' "$(resolvectl dns hoge)"
  81 assert_in '10.0.1.3 10.0.1.4' "$(resolvectl dns hoge.foo)"
  82 if ! RESOLVCONF=$(command -v resolvconf 2>/dev/null); then
  83     TMPDIR=$(mktemp -d -p /tmp resolvconf-tests.XXXXXX)
  84     RESOLVCONF="$TMPDIR"/resolvconf
  85     ln -s "$(command -v resolvectl 2>/dev/null)" "$RESOLVCONF"
  86 fi
  87 echo nameserver 10.0.2.1 10.0.2.2 | "$RESOLVCONF" -a hoge
  88 echo nameserver 10.0.2.3 10.0.2.4 | "$RESOLVCONF" -a hoge.foo
  89 assert_in '10.0.2.1 10.0.2.2' "$(resolvectl dns hoge)"
  90 assert_in '10.0.2.3 10.0.2.4' "$(resolvectl dns hoge.foo)"
  91 echo nameserver 10.0.3.1 10.0.3.2 | "$RESOLVCONF" -a hoge.inet.ipsec.192.168.35
  92 echo nameserver 10.0.3.3 10.0.3.4 | "$RESOLVCONF" -a hoge.foo.dhcp
  93 assert_in '10.0.3.1 10.0.3.2' "$(resolvectl dns hoge)"
  94 assert_in '10.0.3.3 10.0.3.4' "$(resolvectl dns hoge.foo)"
  95
  96 # Tests for _localdnsstub and _localdnsproxy
  97 assert_in '127.0.0.53' "$(resolvectl query _localdnsstub)"
  98 assert_in '_localdnsstub' "$(resolvectl query 127.0.0.53)"
  99 assert_in '127.0.0.54' "$(resolvectl query _localdnsproxy)"
 100 assert_in '_localdnsproxy' "$(resolvectl query 127.0.0.54)"
 101
 102 assert_in '127.0.0.53' "$(dig @127.0.0.53 _localdnsstub)"
 103 assert_in '_localdnsstub' "$(dig @127.0.0.53 -x 127.0.0.53)"
 104 assert_in '127.0.0.54' "$(dig @127.0.0.53 _localdnsproxy)"
 105 assert_in '_localdnsproxy' "$(dig @127.0.0.53 -x 127.0.0.54)"
 106
 107 # Tests for mDNS and LLMNR settings
 108 mkdir -p /run/systemd/resolved.conf.d
 109 {
 110     echo "[Resolve]"
 111     echo "MulticastDNS=no"
 112     echo "LLMNR=no"
 113 } >/run/systemd/resolved.conf.d/mdns-llmnr.conf
 114 restart_resolved
 115 # make sure networkd is not running.
 116 systemctl stop systemd-networkd.service
 117 assert_in 'no' "$(resolvectl mdns hoge)"
 118 assert_in 'no' "$(resolvectl llmnr hoge)"
 119 # Tests that reloading works
 120 {
 121     echo "[Resolve]"
 122     echo "MulticastDNS=yes"
 123     echo "LLMNR=yes"
 124 } >/run/systemd/resolved.conf.d/mdns-llmnr.conf
 125 systemctl reload systemd-resolved.service
 126 # defaults to yes (both the global and per-link settings are yes)
 127 assert_in 'yes' "$(resolvectl mdns hoge)"
 128 assert_in 'yes' "$(resolvectl llmnr hoge)"
 129 # set per-link setting
 130 resolvectl mdns hoge yes
 131 resolvectl llmnr hoge yes
 132 assert_in 'yes' "$(resolvectl mdns hoge)"
 133 assert_in 'yes' "$(resolvectl llmnr hoge)"
 134 resolvectl mdns hoge resolve
 135 resolvectl llmnr hoge resolve
 136 assert_in 'resolve' "$(resolvectl mdns hoge)"
 137 assert_in 'resolve' "$(resolvectl llmnr hoge)"
 138 resolvectl mdns hoge no
 139 resolvectl llmnr hoge no
 140 assert_in 'no' "$(resolvectl mdns hoge)"
 141 assert_in 'no' "$(resolvectl llmnr hoge)"
 142 # downgrade global setting to resolve
 143 {
 144     echo "[Resolve]"
 145     echo "MulticastDNS=resolve"
 146     echo "LLMNR=resolve"
 147 } >/run/systemd/resolved.conf.d/mdns-llmnr.conf
 148 systemctl reload systemd-resolved.service
 149 # set per-link setting
 150 resolvectl mdns hoge yes
 151 resolvectl llmnr hoge yes
 152 assert_in 'resolve' "$(resolvectl mdns hoge)"
 153 assert_in 'resolve' "$(resolvectl llmnr hoge)"
 154 resolvectl mdns hoge resolve
 155 resolvectl llmnr hoge resolve
 156 assert_in 'resolve' "$(resolvectl mdns hoge)"
 157 assert_in 'resolve' "$(resolvectl llmnr hoge)"
 158 resolvectl mdns hoge no
 159 resolvectl llmnr hoge no
 160 assert_in 'no' "$(resolvectl mdns hoge)"
 161 assert_in 'no' "$(resolvectl llmnr hoge)"
 162 # downgrade global setting to no
 163 {
 164     echo "[Resolve]"
 165     echo "MulticastDNS=no"
 166     echo "LLMNR=no"
 167 } >/run/systemd/resolved.conf.d/mdns-llmnr.conf
 168 systemctl reload systemd-resolved.service
 169 # set per-link setting
 170 resolvectl mdns hoge yes
 171 resolvectl llmnr hoge yes
 172 assert_in 'no' "$(resolvectl mdns hoge)"
 173 assert_in 'no' "$(resolvectl llmnr hoge)"
 174 resolvectl mdns hoge resolve
 175 resolvectl llmnr hoge resolve
 176 assert_in 'no' "$(resolvectl mdns hoge)"
 177 assert_in 'no' "$(resolvectl llmnr hoge)"
 178 resolvectl mdns hoge no
 179 resolvectl llmnr hoge no
 180 assert_in 'no' "$(resolvectl mdns hoge)"
 181 assert_in 'no' "$(resolvectl llmnr hoge)"
 182
 183 # Cleanup
 184 rm -f /run/systemd/resolved.conf.d/mdns-llmnr.conf
 185 ip link del hoge
 186 ip link del hoge.foo
 187
 188 ### SETUP ###
 189 # Configure network
 190 hostnamectl hostname ns1.unsigned.test
 191 cat >>/etc/hosts <<EOF
 192 10.0.0.1               ns1.unsigned.test
 193 fd00:dead:beef:cafe::1 ns1.unsigned.test
 194
 195 127.128.0.5     localhost5 localhost5.localdomain localhost5.localdomain4 localhost.localdomain5 localhost5.localdomain5
 196 EOF
 197
 198 mkdir -p /run/systemd/network
 199 cat >/run/systemd/network/10-dns0.netdev <<EOF
 200 [NetDev]
 201 Name=dns0
 202 Kind=dummy
 203 EOF
 204 cat >/run/systemd/network/10-dns0.network <<EOF
 205 [Match]
 206 Name=dns0
 207
 208 [Network]
 209 IPv6AcceptRA=no
 210 Address=10.0.0.1/24
 211 Address=fd00:dead:beef:cafe::1/64
 212 DNSSEC=allow-downgrade
 213 DNS=10.0.0.1
 214 DNS=fd00:dead:beef:cafe::1
 215 EOF
 216 cat >/run/systemd/network/10-dns1.netdev <<EOF
 217 [NetDev]
 218 Name=dns1
 219 Kind=dummy
 220 EOF
 221 cat >/run/systemd/network/10-dns1.network <<EOF
 222 [Match]
 223 Name=dns1
 224
 225 [Network]
 226 IPv6AcceptRA=no
 227 Address=10.99.0.1/24
 228 DNSSEC=no
 229 EOF
 230 systemctl edit --stdin --full --runtime --force "resolved-dummy-server.service" <<EOF
 231 [Service]
 232 Type=notify
 233 Environment=SYSTEMD_LOG_LEVEL=debug
 234 ExecStart=/usr/lib/systemd/tests/unit-tests/manual/test-resolved-dummy-server 10.99.0.1:53
 235 EOF
 236
 237 DNS_ADDRESSES=(
 238     "10.0.0.1"
 239     "fd00:dead:beef:cafe::1"
 240 )
 241
 242 mkdir -p /run/systemd/resolved.conf.d
 243 {
 244     echo "[Resolve]"
 245     echo "FallbackDNS="
 246     echo "DNSSEC=allow-downgrade"
 247     echo "DNSOverTLS=opportunistic"
 248 } >/run/systemd/resolved.conf.d/test.conf
 249 ln -svf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
 250 # Override the default NTA list, which turns off DNSSEC validation for (among
 251 # others) the test. domain
 252 mkdir -p "/etc/dnssec-trust-anchors.d/"
 253 echo local >/etc/dnssec-trust-anchors.d/local.negative
 254
 255 # Copy over our knot configuration
 256 mkdir -p /var/lib/knot/zones/ /etc/knot/
 257 cp -rfv /usr/lib/systemd/tests/testdata/knot-data/zones/* /var/lib/knot/zones/
 258 cp -fv /usr/lib/systemd/tests/testdata/knot-data/knot.conf /etc/knot/knot.conf
 259 chgrp -R knot /etc/knot/ /var/lib/knot/
 260 chmod -R ug+rwX /var/lib/knot/
 261 chmod -R g+r /etc/knot/
 262
 263 # Sign the root zone
 264 keymgr . generate algorithm=ECDSAP256SHA256 ksk=yes zsk=yes
 265 # Create a trust anchor for resolved with our root zone
 266 keymgr . ds | sed 's/ DS/ IN DS/g' >/etc/dnssec-trust-anchors.d/root.positive
 267 # Create a bind-compatible trust anchor (for delv)
 268 # Note: the trust-anchors directive is relatively new, so use the original
 269 #       managed-keys one until it's widespread enough
 270 {
 271     echo 'managed-keys {'
 272     keymgr . dnskey | sed -r 's/^\. DNSKEY ([0-9]+ [0-9]+ [0-9]+) (.+)$/. static-key \1 "\2";/g'
 273     echo '};'
 274 } >/etc/bind.keys
 275 # Create an /etc/bind/bind.keys symlink, which is used by delv on Ubuntu
 276 mkdir -p /etc/bind
 277 ln -svf /etc/bind.keys /etc/bind/bind.keys
 278
 279 # Start the services
 280 systemctl unmask systemd-networkd
 281 systemctl restart systemd-networkd
 282 /usr/lib/systemd/systemd-networkd-wait-online --interface=dns1:routable --timeout=60
 283 systemctl reload systemd-resolved
 284 systemctl start resolved-dummy-server
 285
 286 # Create knot's runtime dir, since from certain version it's provided only by
 287 # the package and not created by tmpfiles/systemd
 288 if [[ ! -d /run/knot ]]; then
 289     mkdir -p /run/knot
 290     chown -R knot:knot /run/knot
 291 fi
 292 systemctl start knot
 293 # Wait a bit for the keys to propagate
 294 sleep 4
 295
 296 systemctl status resolved-dummy-server
 297 networkctl status
 298 resolvectl status
 299 resolvectl log-level debug
 300
 301 # Start monitoring queries
 302 systemd-run -u resolvectl-monitor.service -p Type=notify resolvectl monitor
 303 systemd-run -u resolvectl-monitor-json.service -p Type=notify resolvectl monitor --json=short
 304
 305 # FIXME: knot, unfortunately, incorrectly complains about missing zone files for zones
 306 #        that are forwarded using the `dnsproxy` module. Until the issue is resolved,
 307 #        let's fall back to pre-processing the `zone-check` output a bit before checking it
 308 #
 309 # See: https://gitlab.nic.cz/knot/knot-dns/-/issues/913
 310 run knotc zone-check || :
 311 sed -i '/forwarded.test./d' "$RUN_OUT"
 312 [[ ! -s "$RUN_OUT" ]]
 313 # We need to manually propagate the DS records of onlinesign.test. to the parent
 314 # zone, since they're generated online
 315 knotc zone-begin test.
 316 if knotc zone-get test. onlinesign.test. ds | grep .; then
 317     # Drop any old DS records, if present (e.g. on test re-run)
 318     knotc zone-unset test. onlinesign.test. ds
 319 fi
 320 # Propagate the new DS records
 321 while read -ra line; do
 322     knotc zone-set test. "${line[0]}" 600 "${line[@]:1}"
 323 done < <(keymgr onlinesign.test. ds)
 324 knotc zone-commit test.
 325
 326 knotc reload
 327 sleep 2
 328
 329 ### SETUP END ###
 330
 331 : "--- nss-resolve/nss-myhostname tests"
 332 # Sanity check
 333 TIMESTAMP=$(date '+%F %T')
 334 # Issue: https://github.com/systemd/systemd/issues/23951
 335 # With IPv6 enabled
 336 run getent -s resolve ahosts ns1.unsigned.test
 337 grep -qE "^fd00:dead:beef:cafe::1\s+STREAM\s+ns1\.unsigned\.test" "$RUN_OUT"
 338 monitor_check_rr "$TIMESTAMP" "ns1.unsigned.test IN AAAA fd00:dead:beef:cafe::1"
 339 # With IPv6 disabled
 340 # Issue: https://github.com/systemd/systemd/issues/23951
 341 disable_ipv6
 342 run getent -s resolve ahosts ns1.unsigned.test
 343 grep -qE "^10\.0\.0\.1\s+STREAM\s+ns1\.unsigned\.test" "$RUN_OUT"
 344 (! grep -qE "fd00:dead:beef:cafe::1" "$RUN_OUT")
 345 monitor_check_rr "$TIMESTAMP" "ns1.unsigned.test IN A 10.0.0.1"
 346 enable_ipv6
 347
 348 # Issue: https://github.com/systemd/systemd/issues/18812
 349 # PR: https://github.com/systemd/systemd/pull/18896
 350 # Follow-up issue: https://github.com/systemd/systemd/issues/23152
 351 # Follow-up PR: https://github.com/systemd/systemd/pull/23161
 352 # With IPv6 enabled
 353 run getent -s resolve ahosts localhost
 354 grep -qE "^::1\s+STREAM\s+localhost" "$RUN_OUT"
 355 run getent -s myhostname ahosts localhost
 356 grep -qE "^::1\s+STREAM\s+localhost" "$RUN_OUT"
 357 # With IPv6 disabled
 358 disable_ipv6
 359 run getent -s resolve ahosts localhost
 360 grep -qE "^127\.0\.0\.1\s+STREAM\s+localhost" "$RUN_OUT"
 361 (! grep -qE "::1" "$RUN_OUT")
 362 run getent -s myhostname ahosts localhost
 363 grep -qE "^127\.0\.0\.1\s+STREAM\s+localhost" "$RUN_OUT"
 364 enable_ipv6
 365
 366 # Issue: https://github.com/systemd/systemd/issues/25088
 367 run getent -s resolve hosts 127.128.0.5
 368 grep -qEx '127\.128\.0\.5\s+localhost5(\s+localhost5?\.localdomain[45]?){4}' "$RUN_OUT"
 369 [ "$(wc -l <"$RUN_OUT")" -eq 1 ]
 370
 371 # Issue: https://github.com/systemd/systemd/issues/20158
 372 run dig +noall +answer +additional localhost5.
 373 grep -qEx 'localhost5\.\s+0\s+IN\s+A\s+127\.128\.0\.5' "$RUN_OUT"
 374 [ "$(wc -l <"$RUN_OUT")" -eq 1 ]
 375 run dig +noall +answer +additional localhost5.localdomain4.
 376 grep -qEx 'localhost5\.localdomain4\.\s+0\s+IN\s+CNAME\s+localhost5\.' "$RUN_OUT"
 377 grep -qEx 'localhost5\.\s+0\s+IN\s+A\s+127\.128\.0\.5' "$RUN_OUT"
 378 [ "$(wc -l <"$RUN_OUT")" -eq 2 ]
 379
 380 : "--- Basic resolved tests ---"
 381 # Issue: https://github.com/systemd/systemd/issues/22229
 382 # PR: https://github.com/systemd/systemd/pull/22231
 383 FILTERED_NAMES=(
 384     "0.in-addr.arpa"
 385     "255.255.255.255.in-addr.arpa"
 386     "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa"
 387     "hello.invalid"
 388     "hello.alt"
 389 )
 390
 391 for name in "${FILTERED_NAMES[@]}"; do
 392     (! run host "$name")
 393     grep -qF "NXDOMAIN" "$RUN_OUT"
 394 done
 395
 396 # Follow-up
 397 # Issue: https://github.com/systemd/systemd/issues/22401
 398 # PR: https://github.com/systemd/systemd/pull/22414
 399 run dig +noall +authority +comments SRV .
 400 grep -qF "status: NOERROR" "$RUN_OUT"
 401 grep -qE "IN\s+SOA\s+ns1\.unsigned\.test\." "$RUN_OUT"
 402
 403 run resolvectl query -t SVCB svcb.test
 404 grep -qF 'alpn="dot"' "$RUN_OUT"
 405 grep -qF "ipv4hint=10.0.0.1" "$RUN_OUT"
 406
 407 run resolvectl query -t HTTPS https.test
 408 grep -qF 'alpn="h2,h3"' "$RUN_OUT"
 409
 410 : "--- ZONE: unsigned.test. ---"
 411 run dig @ns1.unsigned.test +short unsigned.test A unsigned.test AAAA
 412 grep -qF "10.0.0.101" "$RUN_OUT"
 413 grep -qF "fd00:dead:beef:cafe::101" "$RUN_OUT"
 414 run resolvectl query unsigned.test
 415 grep -qF "10.0.0.10" "$RUN_OUT"
 416 grep -qF "fd00:dead:beef:cafe::101" "$RUN_OUT"
 417 grep -qF "authenticated: no" "$RUN_OUT"
 418 run dig @ns1.unsigned.test +short MX unsigned.test
 419 grep -qF "15 mail.unsigned.test." "$RUN_OUT"
 420 run resolvectl query --legend=no -t MX unsigned.test
 421 grep -qF "unsigned.test IN MX 15 mail.unsigned.test" "$RUN_OUT"
 422
 423
 424 : "--- ZONE: signed.test (static DNSSEC) ---"
 425 # Check the trust chain (with and without systemd-resolved in between
 426 # Issue: https://github.com/systemd/systemd/issues/22002
 427 # PR: https://github.com/systemd/systemd/pull/23289
 428 run_delv @ns1.unsigned.test signed.test
 429 grep -qF "; fully validated" "$RUN_OUT"
 430 run_delv signed.test
 431 grep -qF "; fully validated" "$RUN_OUT"
 432
 433 for addr in "${DNS_ADDRESSES[@]}"; do
 434     run_delv "@$addr" -t A mail.signed.test
 435     grep -qF "; fully validated" "$RUN_OUT"
 436     run_delv "@$addr" -t AAAA mail.signed.test
 437     grep -qF "; fully validated" "$RUN_OUT"
 438 done
 439 run resolvectl query mail.signed.test
 440 grep -qF "10.0.0.11" "$RUN_OUT"
 441 grep -qF "fd00:dead:beef:cafe::11" "$RUN_OUT"
 442 grep -qF "authenticated: yes" "$RUN_OUT"
 443
 444 run dig +short signed.test
 445 grep -qF "10.0.0.10" "$RUN_OUT"
 446 run resolvectl query signed.test
 447 grep -qF "signed.test: 10.0.0.10" "$RUN_OUT"
 448 grep -qF "authenticated: yes" "$RUN_OUT"
 449 run dig @ns1.unsigned.test +short MX signed.test
 450 grep -qF "10 mail.signed.test." "$RUN_OUT"
 451 run resolvectl query --legend=no -t MX signed.test
 452 grep -qF "signed.test IN MX 10 mail.signed.test" "$RUN_OUT"
 453 # Check a non-existent domain
 454 run dig +dnssec this.does.not.exist.signed.test
 455 grep -qF "status: NXDOMAIN" "$RUN_OUT"
 456 # Check a wildcard record
 457 run resolvectl query -t TXT this.should.be.authenticated.wild.signed.test
 458 grep -qF 'this.should.be.authenticated.wild.signed.test IN TXT "this is a wildcard"' "$RUN_OUT"
 459 grep -qF "authenticated: yes" "$RUN_OUT"
 460 # Check SRV support
 461 run resolvectl service _mysvc._tcp signed.test
 462 grep -qF "myservice.signed.test:1234" "$RUN_OUT"
 463 grep -qF "10.0.0.20" "$RUN_OUT"
 464 grep -qF "fd00:dead:beef:cafe::17" "$RUN_OUT"
 465 grep -qF "authenticated: yes" "$RUN_OUT"
 466
 467 # Test service resolve over Varlink
 468 run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveService '{"name":"","type":"_mysvc._tcp","domain":"signed.test"}'
 469 grep -qF '"services":[{"priority":10,"weight":5,"port":1234,"hostname":"myservice.signed.test","canonicalName":"myservice.signed.test","addresses":[{"ifindex":' "$RUN_OUT"
 470 grep -qF '"family":10,"address":[253,0,222,173,190,239,202,254,0,0,0,0,0,0,0,23]' "$RUN_OUT"
 471 grep -qF '"family":2,"address":[10,0,0,20]' "$RUN_OUT"
 472 grep -qF '}]}],"txt":["This is TXT for myservice"],"canonical":{"name":null,"type":"_mysvc._tcp","domain":"signed.test"},"flags":' "$RUN_OUT"
 473
 474 # without name
 475 run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveService '{"type":"_mysvc._tcp","domain":"signed.test"}'
 476 # without txt (SD_RESOLVE_NO_TXT)
 477 run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveService '{"type":"_mysvc._tcp","domain":"signed.test","flags":64}'
 478 (! grep -qF '"txt"' "$RUN_OUT")
 479 # without address (SD_RESOLVE_NO_ADDRESS)
 480 run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveService '{"type":"_mysvc._tcp","domain":"signed.test","flags":128}'
 481 (! grep -qF '"addresses"' "$RUN_OUT")
 482 # without txt and address
 483 run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveService '{"type":"_mysvc._tcp","domain":"signed.test","flags":192}'
 484 (! grep -qF '"txt"' "$RUN_OUT")
 485 (! grep -qF '"addresses"' "$RUN_OUT")
 486
 487 (! run resolvectl service _invalidsvc._udp signed.test)
 488 grep -qE "invalidservice\.signed\.test' not found" "$RUN_OUT"
 489 run resolvectl service _untrustedsvc._udp signed.test
 490 grep -qF "myservice.untrusted.test:1111" "$RUN_OUT"
 491 grep -qF "10.0.0.123" "$RUN_OUT"
 492 grep -qF "fd00:dead:beef:cafe::123" "$RUN_OUT"
 493 grep -qF "authenticated: yes" "$RUN_OUT"
 494 # Check OPENPGPKEY support
 495 run_delv -t OPENPGPKEY 5a786cdc59c161cdafd818143705026636962198c66ed4c5b3da321e._openpgpkey.signed.test
 496 grep -qF "; fully validated" "$RUN_OUT"
 497 run resolvectl openpgp mr.smith@signed.test
 498 grep -qF "5a786cdc59c161cdafd818143705026636962198c66ed4c5b3da321e._openpgpkey.signed.test" "$RUN_OUT"
 499 grep -qF "authenticated: yes" "$RUN_OUT"
 500 # Check zone transfers (AXFR/IXFR)
 501 # Note: since resolved doesn't support zone transfers, let's just make sure it
 502 #       simply refuses such requests without choking on them
 503 # See: https://github.com/systemd/systemd/pull/30809#issuecomment-1880102804
 504 run dig @ns1.unsigned.test AXFR signed.test
 505 grep -qE "SOA\s+ns1.unsigned.test. root.unsigned.test." "$RUN_OUT"
 506 run dig AXFR signed.test
 507 grep -qF "; Transfer failed" "$RUN_OUT"
 508 run dig @ns1.unsigned.test IXFR=43 signed.test
 509 grep -qE "SOA\s+ns1.unsigned.test. root.unsigned.test." "$RUN_OUT"
 510 run dig IXFR=43 signed.test
 511 grep -qF "; Transfer failed" "$RUN_OUT"
 512
 513 # DNSSEC validation with multiple records of the same type for the same name
 514 # Issue: https://github.com/systemd/systemd/issues/22002
 515 # PR: https://github.com/systemd/systemd/pull/23289
 516 check_domain() {
 517     local domain="${1:?}"
 518     local record="${2:?}"
 519     local message="${3:?}"
 520     local addr
 521
 522     for addr in "${DNS_ADDRESSES[@]}"; do
 523         run_delv "@$addr" -t "$record" "$domain"
 524         grep -qF "$message" "$RUN_OUT"
 525     done
 526
 527     run_delv -t "$record" "$domain"
 528     grep -qF "$message" "$RUN_OUT"
 529
 530     run resolvectl query "$domain"
 531     grep -qF "authenticated: yes" "$RUN_OUT"
 532 }
 533
 534 check_domain "dupe.signed.test"       "A"    "; fully validated"
 535 check_domain "dupe.signed.test"       "AAAA" "; negative response, fully validated"
 536 check_domain "dupe-ipv6.signed.test"  "AAAA" "; fully validated"
 537 check_domain "dupe-ipv6.signed.test"  "A"    "; negative response, fully validated"
 538 check_domain "dupe-mixed.signed.test" "A"    "; fully validated"
 539 check_domain "dupe-mixed.signed.test" "AAAA" "; fully validated"
 540
 541 # Test resolution of CNAME chains
 542 TIMESTAMP=$(date '+%F %T')
 543 run resolvectl query -t A cname-chain.signed.test
 544 grep -qF "follow14.final.signed.test IN A 10.0.0.14" "$RUN_OUT"
 545 grep -qF "authenticated: yes" "$RUN_OUT"
 546
 547 monitor_check_rr "$TIMESTAMP" "follow10.so.close.signed.test IN CNAME follow11.yet.so.far.signed.test"
 548 monitor_check_rr "$TIMESTAMP" "follow11.yet.so.far.signed.test IN CNAME follow12.getting.hot.signed.test"
 549 monitor_check_rr "$TIMESTAMP" "follow12.getting.hot.signed.test IN CNAME follow13.almost.final.signed.test"
 550 monitor_check_rr "$TIMESTAMP" "follow13.almost.final.signed.test IN CNAME follow14.final.signed.test"
 551 monitor_check_rr "$TIMESTAMP" "follow14.final.signed.test IN A 10.0.0.14"
 552
 553 # Non-existing RR + CNAME chain
 554 #run dig +dnssec AAAA cname-chain.signed.test
 555 #grep -qF "status: NOERROR" "$RUN_OUT"
 556 #grep -qE "^follow14\.final\.signed\.test\..+IN\s+NSEC\s+" "$RUN_OUT"
 557
 558
 559 : "--- ZONE: onlinesign.test (dynamic DNSSEC) ---"
 560 # Check the trust chain (with and without systemd-resolved in between
 561 # Issue: https://github.com/systemd/systemd/issues/22002
 562 # PR: https://github.com/systemd/systemd/pull/23289
 563 run_delv @ns1.unsigned.test sub.onlinesign.test
 564 grep -qF "; fully validated" "$RUN_OUT"
 565 run_delv sub.onlinesign.test
 566 grep -qF "; fully validated" "$RUN_OUT"
 567
 568 run dig +short sub.onlinesign.test
 569 grep -qF "10.0.0.133" "$RUN_OUT"
 570 run resolvectl query sub.onlinesign.test
 571 grep -qF "sub.onlinesign.test: 10.0.0.133" "$RUN_OUT"
 572 grep -qF "authenticated: yes" "$RUN_OUT"
 573 run dig @ns1.unsigned.test +short TXT onlinesign.test
 574 grep -qF '"hello from onlinesign"' "$RUN_OUT"
 575 run resolvectl query --legend=no -t TXT onlinesign.test
 576 grep -qF 'onlinesign.test IN TXT "hello from onlinesign"' "$RUN_OUT"
 577
 578 for addr in "${DNS_ADDRESSES[@]}"; do
 579     run_delv "@$addr" -t A dual.onlinesign.test
 580     grep -qF "10.0.0.135" "$RUN_OUT"
 581     run_delv "@$addr" -t AAAA dual.onlinesign.test
 582     grep -qF "fd00:dead:beef:cafe::135" "$RUN_OUT"
 583     run_delv "@$addr" -t ANY ipv6.onlinesign.test
 584     grep -qF "fd00:dead:beef:cafe::136" "$RUN_OUT"
 585 done
 586 run resolvectl query dual.onlinesign.test
 587 grep -qF "10.0.0.135" "$RUN_OUT"
 588 grep -qF "fd00:dead:beef:cafe::135" "$RUN_OUT"
 589 grep -qF "authenticated: yes" "$RUN_OUT"
 590 run resolvectl query ipv6.onlinesign.test
 591 grep -qF "fd00:dead:beef:cafe::136" "$RUN_OUT"
 592 grep -qF "authenticated: yes" "$RUN_OUT"
 593
 594 # Check a non-existent domain
 595 # Note: mod-onlinesign utilizes Minimally Covering NSEC Records, hence the
 596 #       different response than with "standard" DNSSEC
 597 run dig +dnssec this.does.not.exist.onlinesign.test
 598 grep -qF "status: NOERROR" "$RUN_OUT"
 599 grep -qF "NSEC \\000.this.does.not.exist.onlinesign.test." "$RUN_OUT"
 600 # Check a wildcard record
 601 run resolvectl query -t TXT this.should.be.authenticated.wild.onlinesign.test
 602 grep -qF 'this.should.be.authenticated.wild.onlinesign.test IN TXT "this is an onlinesign wildcard"' "$RUN_OUT"
 603 grep -qF "authenticated: yes" "$RUN_OUT"
 604
 605 # Resolve via dbus method
 606 TIMESTAMP=$(date '+%F %T')
 607 run busctl call org.freedesktop.resolve1 /org/freedesktop/resolve1 org.freedesktop.resolve1.Manager ResolveHostname 'isit' 0 secondsub.onlinesign.test 0 0
 608 grep -qF '10 0 0 134 "secondsub.onlinesign.test"' "$RUN_OUT"
 609 monitor_check_rr "$TIMESTAMP" "secondsub.onlinesign.test IN A 10.0.0.134"
 610
 611
 612 : "--- ZONE: untrusted.test (DNSSEC without propagated DS records) ---"
 613 # Issue: https://github.com/systemd/systemd/issues/23955
 614 # FIXME
 615 resolvectl flush-caches
 616 #run dig +short untrusted.test A untrusted.test AAAA
 617 #grep -qF "10.0.0.121" "$RUN_OUT"
 618 #grep -qF "fd00:dead:beef:cafe::121" "$RUN_OUT"
 619 run resolvectl query untrusted.test
 620 grep -qF "untrusted.test:" "$RUN_OUT"
 621 grep -qF "10.0.0.121" "$RUN_OUT"
 622 grep -qF "fd00:dead:beef:cafe::121" "$RUN_OUT"
 623 grep -qF "authenticated: no" "$RUN_OUT"
 624 run resolvectl service _mysvc._tcp untrusted.test
 625 grep -qF "myservice.untrusted.test:1234" "$RUN_OUT"
 626 grep -qF "10.0.0.123" "$RUN_OUT"
 627 grep -qF "fd00:dead:beef:cafe::123" "$RUN_OUT"
 628
 629 # Issue: https://github.com/systemd/systemd/issues/19472
 630 # 1) Query for a non-existing RR should return NOERROR + NSEC (?), not NXDOMAIN
 631 # FIXME: re-enable once the issue is resolved
 632 #run dig +dnssec AAAA untrusted.test
 633 #grep -qF "status: NOERROR" "$RUN_OUT"
 634 #grep -qE "^untrusted\.test\..+IN\s+NSEC\s+" "$RUN_OUT"
 635 ## 2) Query for a non-existing name should return NXDOMAIN, not SERVFAIL
 636 #run dig +dnssec this.does.not.exist.untrusted.test
 637 #grep -qF "status: NXDOMAIN" "$RUN_OUT"
 638
 639 : "--- ZONE: forwarded.test (queries forwarded to our dummy test server) ---"
 640 JOURNAL_CURSOR="$(mktemp)"
 641 journalctl -n0 -q --cursor-file="$JOURNAL_CURSOR"
 642
 643 # See "test-resolved-dummy-server.c" for the server part
 644 (! run resolvectl query nope.forwarded.test)
 645 grep -qF "nope.forwarded.test" "$RUN_OUT"
 646 grep -qF "not found" "$RUN_OUT"
 647
 648 # SERVFAIL + EDE code 6: DNSSEC Bogus
 649 (! run resolvectl query edns-bogus-dnssec.forwarded.test)
 650 grep -qE "^edns-bogus-dnssec.forwarded.test:.+: upstream-failure \(DNSSEC Bogus\)" "$RUN_OUT"
 651 # Same thing, but over Varlink
 652 (! run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveHostname '{"name" : "edns-bogus-dnssec.forwarded.test"}')
 653 grep -qF "io.systemd.Resolve.DNSSECValidationFailed" "$RUN_OUT"
 654 grep -qF '{"result":"upstream-failure","extendedDNSErrorCode":6}' "$RUN_OUT"
 655 journalctl --sync
 656 journalctl -u systemd-resolved.service --cursor-file="$JOURNAL_CURSOR" --grep "Server returned error: SERVFAIL \(DNSSEC Bogus\). Lookup failed."
 657
 658 # SERVFAIL + EDE code 16: Censored + extra text
 659 (! run resolvectl query edns-extra-text.forwarded.test)
 660 grep -qE "^edns-extra-text.forwarded.test.+: SERVFAIL \(Censored: Nothing to see here!\)" "$RUN_OUT"
 661 (! run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveHostname '{"name" : "edns-extra-text.forwarded.test"}')
 662 grep -qF "io.systemd.Resolve.DNSError" "$RUN_OUT"
 663 grep -qF '{"rcode":2,"extendedDNSErrorCode":16,"extendedDNSErrorMessage":"Nothing to see here!"}' "$RUN_OUT"
 664 journalctl --sync
 665 journalctl -u systemd-resolved.service --cursor-file="$JOURNAL_CURSOR" --grep "Server returned error: SERVFAIL \(Censored: Nothing to see here!\)"
 666
 667 # SERVFAIL + EDE code 0: Other + extra text
 668 (! run resolvectl query edns-code-zero.forwarded.test)
 669 grep -qE "^edns-code-zero.forwarded.test:.+: SERVFAIL \(Other: 🐱\)" "$RUN_OUT"
 670 (! run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveHostname '{"name" : "edns-code-zero.forwarded.test"}')
 671 grep -qF "io.systemd.Resolve.DNSError" "$RUN_OUT"
 672 grep -qF '{"rcode":2,"extendedDNSErrorCode":0,"extendedDNSErrorMessage":"🐱"}' "$RUN_OUT"
 673 journalctl --sync
 674 journalctl -u systemd-resolved.service --cursor-file="$JOURNAL_CURSOR" --grep "Server returned error: SERVFAIL \(Other: 🐱\)"
 675
 676 # SERVFAIL + invalid EDE code
 677 (! run resolvectl query edns-invalid-code.forwarded.test)
 678 grep -qE "^edns-invalid-code.forwarded.test:.+: SERVFAIL \([0-9]+\)" "$RUN_OUT"
 679 (! run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveHostname '{"name" : "edns-invalid-code.forwarded.test"}')
 680 grep -qF "io.systemd.Resolve.DNSError" "$RUN_OUT"
 681 grep -qE '{"rcode":2,"extendedDNSErrorCode":[0-9]+}' "$RUN_OUT"
 682 journalctl --sync
 683 journalctl -u systemd-resolved.service --cursor-file="$JOURNAL_CURSOR" --grep "Server returned error: SERVFAIL \(\d+\)"
 684
 685 # SERVFAIL + invalid EDE code + extra text
 686 (! run resolvectl query edns-invalid-code-with-extra-text.forwarded.test)
 687 grep -qE '^edns-invalid-code-with-extra-text.forwarded.test:.+: SERVFAIL \([0-9]+: Hello \[#\]\$%~ World\)' "$RUN_OUT"
 688 (! run varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveHostname '{"name" : "edns-invalid-code-with-extra-text.forwarded.test"}')
 689 grep -qF "io.systemd.Resolve.DNSError" "$RUN_OUT"
 690 grep -qE '{"rcode":2,"extendedDNSErrorCode":[0-9]+,"extendedDNSErrorMessage":"Hello \[#\]\$%~ World"}' "$RUN_OUT"
 691 journalctl --sync
 692 journalctl -u systemd-resolved.service --cursor-file="$JOURNAL_CURSOR" --grep "Server returned error: SERVFAIL \(\d+: Hello \[\#\]\\$%~ World\)"
 693
 694 ### Test resolvectl show-cache
 695 run resolvectl show-cache
 696 run resolvectl show-cache --json=short
 697 run resolvectl show-cache --json=pretty
 698
 699 # Issue: https://github.com/systemd/systemd/issues/29580 (part #1)
 700 dig @127.0.0.54 signed.test
 701
 702 systemctl stop resolvectl-monitor.service
 703 systemctl stop resolvectl-monitor-json.service
 704
 705 # Issue: https://github.com/systemd/systemd/issues/29580 (part #2)
 706 #
 707 # Check for any warnings regarding malformed messages
 708 (! journalctl -u resolvectl-monitor.service -u reseolvectl-monitor-json.service -p warning --grep malformed)
 709 # Verify that all queries recorded by `resolvectl monitor --json` produced a valid JSON
 710 # with expected fields
 711 journalctl -p info -o cat _SYSTEMD_UNIT="resolvectl-monitor-json.service" | while read -r line; do
 712     # Check that both "question" and "answer" fields are arrays
 713     #
 714     # The expression is slightly more complicated due to the fact that the "answer" field is optional,
 715     # so we need to select it only if it's present, otherwise the type == "array" check would fail
 716     echo "$line" | jq -e '[. | .question, (select(has("answer")) | .answer) | type == "array"] | all'
 717 done
 718
 719 # Test serve stale feature and NFTSet= if nftables is installed
 720 if command -v nft >/dev/null; then
 721     ### Test without serve stale feature ###
 722     NFT_FILTER_NAME=dns_port_filter
 723
 724     drop_dns_outbound_traffic() {
 725         nft add table inet $NFT_FILTER_NAME
 726         nft add chain inet $NFT_FILTER_NAME output \{ type filter hook output priority 0 \; \}
 727         nft add rule inet $NFT_FILTER_NAME output ip daddr 10.0.0.1 udp dport 53 drop
 728         nft add rule inet $NFT_FILTER_NAME output ip daddr 10.0.0.1 tcp dport 53 drop
 729         nft add rule inet $NFT_FILTER_NAME output ip6 daddr fd00:dead:beef:cafe::1 udp dport 53 drop
 730         nft add rule inet $NFT_FILTER_NAME output ip6 daddr fd00:dead:beef:cafe::1 tcp dport 53 drop
 731     }
 732
 733     run dig stale1.unsigned.test -t A
 734     grep -qE "NOERROR" "$RUN_OUT"
 735     sleep 2
 736     drop_dns_outbound_traffic
 737     set +e
 738     # Make sure we give sd-resolved enough time to timeout (5-10s) before giving up
 739     # See: https://github.com/systemd/systemd/issues/31639#issuecomment-2009152617
 740     run dig +tries=1 +timeout=15 stale1.unsigned.test -t A
 741     set -eux
 742     grep -qE "no servers could be reached" "$RUN_OUT"
 743     nft flush ruleset
 744
 745     ### Test TIMEOUT with serve stale feature ###
 746
 747     mkdir -p /run/systemd/resolved.conf.d
 748     {
 749         echo "[Resolve]"
 750         echo "StaleRetentionSec=1d"
 751     } >/run/systemd/resolved.conf.d/test.conf
 752     ln -svf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
 753     systemctl reload systemd-resolved.service
 754
 755     run dig stale1.unsigned.test -t A
 756     grep -qE "NOERROR" "$RUN_OUT"
 757     sleep 2
 758     drop_dns_outbound_traffic
 759     # Make sure we give sd-resolved enough time to timeout (5-10s) and serve the stale data (see above)
 760     run dig +tries=1 +timeout=15 stale1.unsigned.test -t A
 761     grep -qE "NOERROR" "$RUN_OUT"
 762     grep -qE "10.0.0.112" "$RUN_OUT"
 763
 764     nft flush ruleset
 765
 766     ### Test NXDOMAIN with serve stale feature ###
 767     # NXDOMAIN response should replace the cache with NXDOMAIN response
 768     run dig stale1.unsigned.test -t A
 769     grep -qE "NOERROR" "$RUN_OUT"
 770     # Delete stale1 record from zone
 771     knotc zone-begin unsigned.test
 772     knotc zone-unset unsigned.test stale1 A
 773     knotc zone-commit unsigned.test
 774     knotc reload
 775     sleep 2
 776     run dig stale1.unsigned.test -t A
 777     grep -qE "NXDOMAIN" "$RUN_OUT"
 778
 779     nft flush ruleset
 780
 781     ### NFTSet= test
 782     nft add table inet sd_test
 783     nft add set inet sd_test c '{ type cgroupsv2; }'
 784     nft add set inet sd_test u '{ typeof meta skuid; }'
 785     nft add set inet sd_test g '{ typeof meta skgid; }'
 786
 787     # service
 788     systemd-run --unit test-nft.service --service-type=exec -p DynamicUser=yes \
 789                 -p 'NFTSet=cgroup:inet:sd_test:c user:inet:sd_test:u group:inet:sd_test:g' sleep 10000
 790     run nft list set inet sd_test c
 791     grep -qF "test-nft.service" "$RUN_OUT"
 792     uid=$(getent passwd test-nft | cut -d':' -f3)
 793     run nft list set inet sd_test u
 794     grep -qF "$uid" "$RUN_OUT"
 795     gid=$(getent passwd test-nft | cut -d':' -f4)
 796     run nft list set inet sd_test g
 797     grep -qF "$gid" "$RUN_OUT"
 798     systemctl stop test-nft.service
 799
 800     # scope
 801     run systemd-run --scope -u test-nft.scope -p 'NFTSet=cgroup:inet:sd_test:c' nft list set inet sd_test c
 802     grep -qF "test-nft.scope" "$RUN_OUT"
 803
 804     mkdir -p /run/systemd/system
 805     # socket
 806     {
 807         echo "[Socket]"
 808         echo "ListenStream=12345"
 809         echo "BindToDevice=lo"
 810         echo "NFTSet=cgroup:inet:sd_test:c"
 811     } >/run/systemd/system/test-nft.socket
 812     {
 813         echo "[Service]"
 814         echo "ExecStart=/usr/bin/sleep 10000"
 815     } >/run/systemd/system/test-nft.service
 816     systemctl daemon-reload
 817     systemctl start test-nft.socket
 818     systemctl status test-nft.socket
 819     run nft list set inet sd_test c
 820     grep -qF "test-nft.socket" "$RUN_OUT"
 821     systemctl stop test-nft.socket
 822     rm -f /run/systemd/system/test-nft.{socket,service}
 823
 824     # slice
 825     mkdir /run/systemd/system/system.slice.d
 826     {
 827         echo "[Slice]"
 828         echo "NFTSet=cgroup:inet:sd_test:c"
 829     } >/run/systemd/system/system.slice.d/00-test-nft.conf
 830     systemctl daemon-reload
 831     run nft list set inet sd_test c
 832     grep -qF "system.slice" "$RUN_OUT"
 833     rm -rf /run/systemd/system/system.slice.d
 834
 835     nft flush ruleset
 836 else
 837     echo "nftables is not installed. Skipped serve stale feature and NFTSet= tests."
 838 fi
 839
 840 ### Test resolvectl show-server-state ###
 841 run resolvectl show-server-state
 842 grep -qF "10.0.0.1" "$RUN_OUT"
 843 grep -qF "Interface" "$RUN_OUT"
 844
 845 run resolvectl show-server-state --json=short
 846 grep -qF "10.0.0.1" "$RUN_OUT"
 847 grep -qF "Interface" "$RUN_OUT"
 848
 849 run resolvectl show-server-state --json=pretty
 850 grep -qF "10.0.0.1" "$RUN_OUT"
 851 grep -qF "Interface" "$RUN_OUT"
 852
 853 ### Test resolvectl statistics ###
 854 run resolvectl statistics
 855 grep -qF "Transactions" "$RUN_OUT"
 856 grep -qF "Cache" "$RUN_OUT"
 857 grep -qF "Failure Transactions" "$RUN_OUT"
 858 grep -qF "DNSSEC Verdicts" "$RUN_OUT"
 859
 860 run resolvectl statistics --json=short
 861 grep -qF "transactions" "$RUN_OUT"
 862 grep -qF "cache" "$RUN_OUT"
 863 grep -qF "dnssec" "$RUN_OUT"
 864
 865 run resolvectl statistics --json=pretty
 866 grep -qF "transactions" "$RUN_OUT"
 867 grep -qF "cache" "$RUN_OUT"
 868 grep -qF "dnssec" "$RUN_OUT"
 869
 870 ### Test resolvectl reset-statistics ###
 871 run resolvectl reset-statistics
 872
 873 run resolvectl reset-statistics --json=pretty
 874
 875 run resolvectl reset-statistics --json=short
 876
 877 test "$(resolvectl --json=short query -t AAAA localhost)" == '{"key":{"class":1,"type":28,"name":"localhost"},"address":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1]}'
 878 test "$(resolvectl --json=short query -t A localhost)" == '{"key":{"class":1,"type":1,"name":"localhost"},"address":[127,0,0,1]}'
 879
 880 # Test ResolveRecord RR resolving via Varlink
 881 test "$(varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveRecord '{"name":"localhost","type":1}' --json=short)" == '{"rrs":[{"ifindex":1,"rr":{"key":{"class":1,"type":1,"name":"localhost"},"address":[127,0,0,1]},"raw":"CWxvY2FsaG9zdAAAAQABAAAAAAAEfwAAAQ=="}],"flags":786945}'
 882 test "$(varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveRecord '{"name":"localhost","type":28}' --json=short)" == '{"rrs":[{"ifindex":1,"rr":{"key":{"class":1,"type":28,"name":"localhost"},"address":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1]},"raw":"CWxvY2FsaG9zdAAAHAABAAAAAAAQAAAAAAAAAAAAAAAAAAAAAQ=="}],"flags":786945}'
 883
 884 # Ensure that reloading keeps the manually configured address
 885 {
 886     echo "[Resolve]"
 887     echo "DNS=8.8.8.8"
 888 } >/run/systemd/resolved.conf.d/reload.conf
 889 resolvectl dns dns0 1.1.1.1
 890 systemctl reload systemd-resolved.service
 891 resolvectl status
 892 resolvectl dns dns0 | grep -qF "1.1.1.1"
 893 # For some reason piping this last command to grep fails with:
 894 # 'resolvectl[1378]: Failed to print table: Broken pipe'
 895 # so use an intermediate file in /tmp/
 896 resolvectl >/tmp/output
 897 grep -qF "DNS Servers: 8.8.8.8" /tmp/output
 898
 899 # Check if resolved exits cleanly.
 900 restart_resolved
 901
 902 touch /testok