From: Otto Date: Tue, 26 Jan 2021 14:54:23 +0000 (+0100) Subject: Allow testing at a specific point in time for SyncRes and primeHints. X-Git-Tag: dnsdist-1.6.0-alpha1~10^2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fpull%2F10014%2Fhead;p=thirdparty%2Fpdns.git Allow testing at a specific point in time for SyncRes and primeHints. Use this to test various signature validation cases at interesting moments in time. Beyond 2106 fails atm. --- diff --git a/pdns/recursordist/test-syncres_cc.cc b/pdns/recursordist/test-syncres_cc.cc index ce1d165b1d..4ac5bb9679 100644 --- a/pdns/recursordist/test-syncres_cc.cc +++ b/pdns/recursordist/test-syncres_cc.cc @@ -75,7 +75,7 @@ LWResult::Result asyncresolve(const ComboAddress& ip, const DNSName& domain, int #include "root-addresses.hh" -bool primeHints(void) +bool primeHints(time_t now) { vector nsset; if (!g_recCache) @@ -88,7 +88,7 @@ bool primeHints(void) arr.d_type = QType::A; aaaarr.d_type = QType::AAAA; nsrr.d_type = QType::NS; - arr.d_ttl = aaaarr.d_ttl = nsrr.d_ttl = time(nullptr) + 3600000; + arr.d_ttl = aaaarr.d_ttl = nsrr.d_ttl = now + 3600000; for (char c = 'a'; c <= 'm'; ++c) { char templ[40]; @@ -100,18 +100,18 @@ bool primeHints(void) arr.d_content = std::make_shared(ComboAddress(rootIps4[c - 'a'])); vector aset; aset.push_back(arr); - g_recCache->replace(time(nullptr), DNSName(templ), QType(QType::A), aset, vector>(), vector>(), true, g_rootdnsname); // auth, nuke it all + g_recCache->replace(now, DNSName(templ), QType(QType::A), aset, vector>(), vector>(), true, g_rootdnsname); // auth, nuke it all if (rootIps6[c - 'a'] != NULL) { aaaarr.d_content = std::make_shared(ComboAddress(rootIps6[c - 'a'])); vector aaaaset; aaaaset.push_back(aaaarr); - g_recCache->replace(time(nullptr), DNSName(templ), QType(QType::AAAA), aaaaset, vector>(), vector>(), true, g_rootdnsname); + g_recCache->replace(now, DNSName(templ), QType(QType::AAAA), aaaaset, vector>(), vector>(), true, g_rootdnsname); } nsset.push_back(nsrr); } - g_recCache->replace(time(nullptr), g_rootdnsname, QType(QType::NS), nsset, vector>(), vector>(), false, g_rootdnsname); // and stuff in the cache + g_recCache->replace(now, g_rootdnsname, QType(QType::NS), nsset, vector>(), vector>(), false, g_rootdnsname); // and stuff in the cache return true; } @@ -492,7 +492,7 @@ LWResult::Result genericDSAndDNSKEYHandler(LWResult* res, const DNSName& domain, if (type == QType::DNSKEY) { setLWResult(res, 0, true, false, true); addDNSKEY(keys, domain, 300, res->d_records); - addRRSIG(keys, res->d_records, domain, 300); + addRRSIG(keys, res->d_records, domain, 300, false, boost::none, boost::none, now); return LWResult::Result::Success; } diff --git a/pdns/recursordist/test-syncres_cc5.cc b/pdns/recursordist/test-syncres_cc5.cc index a2b2472078..7ccb36cf19 100644 --- a/pdns/recursordist/test-syncres_cc5.cc +++ b/pdns/recursordist/test-syncres_cc5.cc @@ -107,6 +107,132 @@ BOOST_AUTO_TEST_CASE(test_dnssec_secure_various_algos) BOOST_CHECK_EQUAL(queriesCount, 8U); } +static void testFixedPointInTime(time_t fixedNow) +{ + std::unique_ptr sr; + initSR(sr, true, false, fixedNow); + + setDNSSECValidation(sr, DNSSECMode::ValidateAll); + + primeHints(fixedNow); + const DNSName target("powerdns.com."); + const ComboAddress targetAddr("192.0.2.42"); + testkeysset_t keys; + + auto luaconfsCopy = g_luaconfs.getCopy(); + luaconfsCopy.dsAnchors.clear(); + generateKeyMaterial(g_rootdnsname, DNSSECKeeper::RSASHA512, DNSSECKeeper::DIGEST_SHA384, keys, luaconfsCopy.dsAnchors); + generateKeyMaterial(DNSName("com."), DNSSECKeeper::ECDSA256, DNSSECKeeper::DIGEST_SHA256, keys); + generateKeyMaterial(DNSName("powerdns.com."), DNSSECKeeper::ECDSA384, DNSSECKeeper::DIGEST_SHA384, keys); + + g_luaconfs.setState(luaconfsCopy); + + size_t queriesCount = 0; + + sr->setAsyncCallback([target, targetAddr, &queriesCount, keys, fixedNow](const ComboAddress& ip, const DNSName& domain, int type, bool doTCP, bool sendRDQuery, int EDNS0Level, struct timeval* now, boost::optional& srcmask, boost::optional context, LWResult* res, bool* chained) { + queriesCount++; + + DNSName auth = domain; + if (domain == target) { + auth = DNSName("powerdns.com."); + } + + if (type == QType::DS || type == QType::DNSKEY) { + return genericDSAndDNSKEYHandler(res, domain, auth, type, keys, true, fixedNow); + } + + if (isRootServer(ip)) { + setLWResult(res, 0, false, false, true); + addRecordToLW(res, "com.", QType::NS, "a.gtld-servers.com.", DNSResourceRecord::AUTHORITY, 3600); + addDS(DNSName("com."), 300, res->d_records, keys); + addRRSIG(keys, res->d_records, DNSName("."), 300, false, boost::none, boost::none, fixedNow); + addRecordToLW(res, "a.gtld-servers.com.", QType::A, "192.0.2.1", DNSResourceRecord::ADDITIONAL, 3600); + return LWResult::Result::Success; + } + + if (ip == ComboAddress("192.0.2.1:53")) { + if (domain == DNSName("com.")) { + setLWResult(res, 0, true, false, true); + addRecordToLW(res, domain, QType::NS, "a.gtld-servers.com."); + addRRSIG(keys, res->d_records, domain, 300, false, boost::none, boost::none, fixedNow); + addRecordToLW(res, "a.gtld-servers.com.", QType::A, "192.0.2.1", DNSResourceRecord::ADDITIONAL, 3600); + addRRSIG(keys, res->d_records, domain, 300, false, boost::none, boost::none, fixedNow); + } + else { + setLWResult(res, 0, false, false, true); + addRecordToLW(res, auth, QType::NS, "ns1.powerdns.com.", DNSResourceRecord::AUTHORITY, 3600); + addDS(auth, 300, res->d_records, keys); + addRRSIG(keys, res->d_records, DNSName("com."), 300, false, boost::none, boost::none, fixedNow); + addRecordToLW(res, "ns1.powerdns.com.", QType::A, "192.0.2.2", DNSResourceRecord::ADDITIONAL, 3600); + } + return LWResult::Result::Success; + } + + if (ip == ComboAddress("192.0.2.2:53")) { + if (type == QType::NS) { + setLWResult(res, 0, true, false, true); + addRecordToLW(res, domain, QType::NS, "ns1.powerdns.com."); + addRRSIG(keys, res->d_records, auth, 300, false, boost::none, boost::none, fixedNow); + addRecordToLW(res, "ns1.powerdns.com.", QType::A, "192.0.2.2", DNSResourceRecord::ADDITIONAL, 3600); + addRRSIG(keys, res->d_records, auth, 300, false, boost::none, boost::none, fixedNow); + } + else { + setLWResult(res, RCode::NoError, true, false, true); + addRecordToLW(res, domain, QType::A, targetAddr.toString(), DNSResourceRecord::ANSWER, 3600); + addRRSIG(keys, res->d_records, auth, 300, false, boost::none, boost::none, fixedNow); + } + return LWResult::Result::Success; + } + + return LWResult::Result::Timeout; + }); + + vector ret; + int res = sr->beginResolve(target, QType(QType::A), QClass::IN, ret); + BOOST_CHECK_EQUAL(res, RCode::NoError); + BOOST_CHECK_EQUAL(sr->getValidationState(), vState::Secure); + BOOST_REQUIRE_EQUAL(ret.size(), 2U); + BOOST_CHECK_EQUAL(queriesCount, 8U); + /* again, to test the cache */ + ret.clear(); + res = sr->beginResolve(target, QType(QType::A), QClass::IN, ret); + BOOST_CHECK_EQUAL(res, RCode::NoError); + BOOST_CHECK_EQUAL(sr->getValidationState(), vState::Secure); + BOOST_REQUIRE_EQUAL(ret.size(), 2U); + BOOST_CHECK_EQUAL(queriesCount, 8U); +} + +BOOST_AUTO_TEST_CASE(test_dnssec_secure_various_algos1970) +{ + /* validity period in ye olde times */ + const time_t fixedNow = 1800; + testFixedPointInTime(fixedNow); +} + +BOOST_AUTO_TEST_CASE(test_dnssec_secure_various_algos2038) +{ + /* validity period contains the wrapping point in 2038 */ + const time_t fixedNow = INT_MAX - 1800; + testFixedPointInTime(fixedNow); +} + +BOOST_AUTO_TEST_CASE(test_dnssec_secure_various_algos2041) +{ + /* validity period completely after 2038 but not wrapping uint32_t*/ + const time_t fixedNow = time_t(INT_MAX) + 100000000; + testFixedPointInTime(fixedNow); +} + +#if 0 +// Currently fails see validate.cc:isRRSIGNotExpired() and isRRSIGIncepted() +BOOST_AUTO_TEST_CASE(test_dnssec_secure_various_algos2106) +{ + /* validity period beyond 2106 uint32_t wrapping point */ + const time_t fixedNow = 2 * time_t(INT_MAX); + testFixedPointInTime(fixedNow); +} +#endif + BOOST_AUTO_TEST_CASE(test_dnssec_secure_a_then_ns) { std::unique_ptr sr; diff --git a/pdns/reczones.cc b/pdns/reczones.cc index 9042df65a7..2bfbfae3c3 100644 --- a/pdns/reczones.cc +++ b/pdns/reczones.cc @@ -42,7 +42,7 @@ static void insertIntoRootNSZones(const DNSName &name) { } } -bool primeHints(void) +bool primeHints(time_t ignored) { // prime root cache const vState validationState = vState::Insecure; diff --git a/pdns/syncres.hh b/pdns/syncres.hh index 1ee7eb1a8e..2a7c8d9d61 100644 --- a/pdns/syncres.hh +++ b/pdns/syncres.hh @@ -1110,7 +1110,7 @@ uint64_t* pleaseGetPacketCacheHits(); uint64_t* pleaseGetPacketCacheSize(); uint64_t* pleaseWipePacketCache(const DNSName& canon, bool subtree, uint16_t qtype=0xffff); void doCarbonDump(void*); -bool primeHints(void); +bool primeHints(time_t now = time(nullptr)); void primeRootNSZones(bool, unsigned int depth); extern __thread struct timeval g_now;