Allow testing at a specific point in time for SyncRes and primeHints.

Use this to test various signature validation cases at interesting
moments in time. Beyond 2106 fails atm.

diff --git a/pdns/recursordist/test-syncres_cc.cc b/pdns/recursordist/test-syncres_cc.cc
index ce1d165b1df837f35ee06885248ebcf809b933e3..4ac5bb96797f7c2429478062b540c5fb14918538 100644 (file)
--- a/pdns/recursordist/test-syncres_cc.cc
+++ b/pdns/recursordist/test-syncres_cc.cc
@@ -75,7 +75,7 @@ LWResult::Result asyncresolve(const ComboAddress& ip, const DNSName& domain, int
 
 #include "root-addresses.hh"
 
-bool primeHints(void)
+bool primeHints(time_t now)
 {
   vector<DNSRecord> nsset;
   if (!g_recCache)
@@ -88,7 +88,7 @@ bool primeHints(void)
   arr.d_type = QType::A;
   aaaarr.d_type = QType::AAAA;
   nsrr.d_type = QType::NS;
-  arr.d_ttl = aaaarr.d_ttl = nsrr.d_ttl = time(nullptr) + 3600000;
+  arr.d_ttl = aaaarr.d_ttl = nsrr.d_ttl = now + 3600000;
 
   for (char c = 'a'; c <= 'm'; ++c) {
     char templ[40];
@@ -100,18 +100,18 @@ bool primeHints(void)
     arr.d_content = std::make_shared<ARecordContent>(ComboAddress(rootIps4[c - 'a']));
     vector<DNSRecord> aset;
     aset.push_back(arr);
-    g_recCache->replace(time(nullptr), DNSName(templ), QType(QType::A), aset, vector<std::shared_ptr<RRSIGRecordContent>>(), vector<std::shared_ptr<DNSRecord>>(), true, g_rootdnsname); // auth, nuke it all
+    g_recCache->replace(now, DNSName(templ), QType(QType::A), aset, vector<std::shared_ptr<RRSIGRecordContent>>(), vector<std::shared_ptr<DNSRecord>>(), true, g_rootdnsname); // auth, nuke it all
     if (rootIps6[c - 'a'] != NULL) {
       aaaarr.d_content = std::make_shared<AAAARecordContent>(ComboAddress(rootIps6[c - 'a']));
 
       vector<DNSRecord> aaaaset;
       aaaaset.push_back(aaaarr);
-      g_recCache->replace(time(nullptr), DNSName(templ), QType(QType::AAAA), aaaaset, vector<std::shared_ptr<RRSIGRecordContent>>(), vector<std::shared_ptr<DNSRecord>>(), true, g_rootdnsname);
+      g_recCache->replace(now, DNSName(templ), QType(QType::AAAA), aaaaset, vector<std::shared_ptr<RRSIGRecordContent>>(), vector<std::shared_ptr<DNSRecord>>(), true, g_rootdnsname);
     }
 
     nsset.push_back(nsrr);
   }
-  g_recCache->replace(time(nullptr), g_rootdnsname, QType(QType::NS), nsset, vector<std::shared_ptr<RRSIGRecordContent>>(), vector<std::shared_ptr<DNSRecord>>(), false, g_rootdnsname); // and stuff in the cache
+  g_recCache->replace(now, g_rootdnsname, QType(QType::NS), nsset, vector<std::shared_ptr<RRSIGRecordContent>>(), vector<std::shared_ptr<DNSRecord>>(), false, g_rootdnsname); // and stuff in the cache
   return true;
 }
 
@@ -492,7 +492,7 @@ LWResult::Result genericDSAndDNSKEYHandler(LWResult* res, const DNSName& domain,
   if (type == QType::DNSKEY) {
     setLWResult(res, 0, true, false, true);
     addDNSKEY(keys, domain, 300, res->d_records);
-    addRRSIG(keys, res->d_records, domain, 300);
+    addRRSIG(keys, res->d_records, domain, 300, false, boost::none, boost::none, now);
     return LWResult::Result::Success;
   }
 

diff --git a/pdns/recursordist/test-syncres_cc5.cc b/pdns/recursordist/test-syncres_cc5.cc
index a2b2472078b9c6961e3804956f534d2ab61e4403..7ccb36cf19906d0ce20465c5bba1571eb9fc9fbd 100644 (file)
--- a/pdns/recursordist/test-syncres_cc5.cc
+++ b/pdns/recursordist/test-syncres_cc5.cc
@@ -107,6 +107,132 @@ BOOST_AUTO_TEST_CASE(test_dnssec_secure_various_algos)
   BOOST_CHECK_EQUAL(queriesCount, 8U);
 }
 
+static void testFixedPointInTime(time_t fixedNow)
+{
+  std::unique_ptr<SyncRes> sr;
+  initSR(sr, true, false, fixedNow);
+
+  setDNSSECValidation(sr, DNSSECMode::ValidateAll);
+
+  primeHints(fixedNow);
+  const DNSName target("powerdns.com.");
+  const ComboAddress targetAddr("192.0.2.42");
+  testkeysset_t keys;
+
+  auto luaconfsCopy = g_luaconfs.getCopy();
+  luaconfsCopy.dsAnchors.clear();
+  generateKeyMaterial(g_rootdnsname, DNSSECKeeper::RSASHA512, DNSSECKeeper::DIGEST_SHA384, keys, luaconfsCopy.dsAnchors);
+  generateKeyMaterial(DNSName("com."), DNSSECKeeper::ECDSA256, DNSSECKeeper::DIGEST_SHA256, keys);
+  generateKeyMaterial(DNSName("powerdns.com."), DNSSECKeeper::ECDSA384, DNSSECKeeper::DIGEST_SHA384, keys);
+
+  g_luaconfs.setState(luaconfsCopy);
+
+  size_t queriesCount = 0;
+
+  sr->setAsyncCallback([target, targetAddr, &queriesCount, keys, fixedNow](const ComboAddress& ip, const DNSName& domain, int type, bool doTCP, bool sendRDQuery, int EDNS0Level, struct timeval* now, boost::optional<Netmask>& srcmask, boost::optional<const ResolveContext&> context, LWResult* res, bool* chained) {
+    queriesCount++;
+
+    DNSName auth = domain;
+    if (domain == target) {
+      auth = DNSName("powerdns.com.");
+    }
+
+    if (type == QType::DS || type == QType::DNSKEY) {
+      return genericDSAndDNSKEYHandler(res, domain, auth, type, keys, true, fixedNow);
+    }
+
+    if (isRootServer(ip)) {
+      setLWResult(res, 0, false, false, true);
+      addRecordToLW(res, "com.", QType::NS, "a.gtld-servers.com.", DNSResourceRecord::AUTHORITY, 3600);
+      addDS(DNSName("com."), 300, res->d_records, keys);
+      addRRSIG(keys, res->d_records, DNSName("."), 300, false, boost::none, boost::none, fixedNow);
+      addRecordToLW(res, "a.gtld-servers.com.", QType::A, "192.0.2.1", DNSResourceRecord::ADDITIONAL, 3600);
+      return LWResult::Result::Success;
+    }
+
+    if (ip == ComboAddress("192.0.2.1:53")) {
+      if (domain == DNSName("com.")) {
+        setLWResult(res, 0, true, false, true);
+        addRecordToLW(res, domain, QType::NS, "a.gtld-servers.com.");
+        addRRSIG(keys, res->d_records, domain, 300, false, boost::none, boost::none, fixedNow);
+        addRecordToLW(res, "a.gtld-servers.com.", QType::A, "192.0.2.1", DNSResourceRecord::ADDITIONAL, 3600);
+        addRRSIG(keys, res->d_records, domain, 300, false, boost::none, boost::none, fixedNow);
+      }
+      else {
+        setLWResult(res, 0, false, false, true);
+        addRecordToLW(res, auth, QType::NS, "ns1.powerdns.com.", DNSResourceRecord::AUTHORITY, 3600);
+        addDS(auth, 300, res->d_records, keys);
+        addRRSIG(keys, res->d_records, DNSName("com."), 300, false, boost::none, boost::none, fixedNow);
+        addRecordToLW(res, "ns1.powerdns.com.", QType::A, "192.0.2.2", DNSResourceRecord::ADDITIONAL, 3600);
+      }
+      return LWResult::Result::Success;
+    }
+
+    if (ip == ComboAddress("192.0.2.2:53")) {
+      if (type == QType::NS) {
+        setLWResult(res, 0, true, false, true);
+        addRecordToLW(res, domain, QType::NS, "ns1.powerdns.com.");
+        addRRSIG(keys, res->d_records, auth, 300, false, boost::none, boost::none, fixedNow);
+        addRecordToLW(res, "ns1.powerdns.com.", QType::A, "192.0.2.2", DNSResourceRecord::ADDITIONAL, 3600);
+        addRRSIG(keys, res->d_records, auth, 300, false, boost::none, boost::none, fixedNow);
+      }
+      else {
+        setLWResult(res, RCode::NoError, true, false, true);
+        addRecordToLW(res, domain, QType::A, targetAddr.toString(), DNSResourceRecord::ANSWER, 3600);
+        addRRSIG(keys, res->d_records, auth, 300, false, boost::none, boost::none, fixedNow);
+      }
+      return LWResult::Result::Success;
+    }
+
+    return LWResult::Result::Timeout;
+  });
+
+  vector<DNSRecord> ret;
+  int res = sr->beginResolve(target, QType(QType::A), QClass::IN, ret);
+  BOOST_CHECK_EQUAL(res, RCode::NoError);
+  BOOST_CHECK_EQUAL(sr->getValidationState(), vState::Secure);
+  BOOST_REQUIRE_EQUAL(ret.size(), 2U);
+  BOOST_CHECK_EQUAL(queriesCount, 8U);
+  /* again, to test the cache */
+  ret.clear();
+  res = sr->beginResolve(target, QType(QType::A), QClass::IN, ret);
+  BOOST_CHECK_EQUAL(res, RCode::NoError);
+  BOOST_CHECK_EQUAL(sr->getValidationState(), vState::Secure);
+  BOOST_REQUIRE_EQUAL(ret.size(), 2U);
+  BOOST_CHECK_EQUAL(queriesCount, 8U);
+}
+
+BOOST_AUTO_TEST_CASE(test_dnssec_secure_various_algos1970)
+{
+  /* validity period in ye olde times */
+  const time_t fixedNow = 1800;
+  testFixedPointInTime(fixedNow);
+}
+
+BOOST_AUTO_TEST_CASE(test_dnssec_secure_various_algos2038)
+{
+  /* validity period contains the wrapping point in 2038 */
+  const time_t fixedNow = INT_MAX - 1800;
+  testFixedPointInTime(fixedNow);
+}
+
+BOOST_AUTO_TEST_CASE(test_dnssec_secure_various_algos2041)
+{
+  /* validity period completely after 2038 but not wrapping uint32_t*/
+  const time_t fixedNow = time_t(INT_MAX) + 100000000;
+  testFixedPointInTime(fixedNow);
+}
+
+#if 0
+// Currently fails see validate.cc:isRRSIGNotExpired() and isRRSIGIncepted()
+BOOST_AUTO_TEST_CASE(test_dnssec_secure_various_algos2106)
+{
+  /* validity period beyond 2106 uint32_t wrapping point */
+  const time_t fixedNow = 2 * time_t(INT_MAX);
+  testFixedPointInTime(fixedNow);
+}
+#endif
+
 BOOST_AUTO_TEST_CASE(test_dnssec_secure_a_then_ns)
 {
   std::unique_ptr<SyncRes> sr;

diff --git a/pdns/reczones.cc b/pdns/reczones.cc
index 9042df65a70a08601ceb6bffad0f1ca618fdaa2f..2bfbfae3c31d8f70f886db675fece1b598b30e12 100644 (file)
--- a/pdns/reczones.cc
+++ b/pdns/reczones.cc
@@ -42,7 +42,7 @@ static void insertIntoRootNSZones(const DNSName &name) {
   }
 }
 
-bool primeHints(void)
+bool primeHints(time_t ignored)
 {
   // prime root cache
   const vState validationState = vState::Insecure;

diff --git a/pdns/syncres.hh b/pdns/syncres.hh
index 1ee7eb1a8e644efa0ae2df18f39f49632e383b5c..2a7c8d9d61d59e1fbc3456cf7414cadc919349c2 100644 (file)
--- a/pdns/syncres.hh
+++ b/pdns/syncres.hh
@@ -1110,7 +1110,7 @@ uint64_t* pleaseGetPacketCacheHits();
 uint64_t* pleaseGetPacketCacheSize();
 uint64_t* pleaseWipePacketCache(const DNSName& canon, bool subtree, uint16_t qtype=0xffff);
 void doCarbonDump(void*);
-bool primeHints(void);
+bool primeHints(time_t now = time(nullptr));
 void primeRootNSZones(bool, unsigned int depth);
 
 extern __thread struct timeval g_now;